Detections
Analytics
CVE-2026-122006
critical
Description
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
References
https://github.com/rubysec/ruby-advisory-db/pull/1300
https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
https://github.com/rails/rails/releases/tag/v8.1.4.1
https://github.com/rails/rails/releases/tag/v8.0.5.2